Analysis

  • max time kernel
    137s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 09:57

General

  • Target

    6f1b274afb60566d225a99686230e5fc_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    6f1b274afb60566d225a99686230e5fc

  • SHA1

    3822be9e24b9f70ef74f76954bc16f4e94716681

  • SHA256

    68e97dd1957f856617147605fed67146f308e66a620bf871a282ee32468954eb

  • SHA512

    c81b507c483fd09695934431f8e213802de0029e9c1ffc24bd47e1a2c9770082515dcebf61fc8e6374345f72d62a1896669ab7cb8ffaa3c5982cda08f43df058

  • SSDEEP

    24576:93LJTrwiuXZgMbTgN0vpOJrZiv2f5Jr+sAaXZCWdYx4uamwqIqkALq2WOLry5:93tTreZJWBM+RjQWmamwtqBLLC

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6f1b274afb60566d225a99686230e5fc_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\PKSQOU\GQH.exe
      "C:\Windows\PKSQOU\GQH.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\PKSQOU\AKV.exe

    Filesize

    489KB

    MD5

    0725c70d7b45945089905464a2710dc8

    SHA1

    a47223eb378919afc8c2a6af6b031bca12eacaae

    SHA256

    5340cf0385c1ccf9a5f01e9bbcb68474d5760c1c60bd87772fbd8a498208a3c5

    SHA512

    3b95b3c582c2df9a59c2aaa5e9f04ea093dda8b53a7df4b966d46c6f61643e8beed3e3cca0e784301f5f14ea17e2520ecf10dca0ae805e5b31bd51ac94d10888

  • C:\Windows\PKSQOU\GQH.001

    Filesize

    61KB

    MD5

    513c67ebf0379f75a6920540283a4579

    SHA1

    2fe191acb478d62026a8dbf63f65619d168ddee6

    SHA256

    8f636876880c59251548fca626731e648553e0b81b02f4667c22cbfadfbd6e30

    SHA512

    2330f5bbd8d7de91473430bc35a125fe13b261afa5b4ef9533d4d6ebcde6cfe27f705fccbdefa092eb9123eb33dcc1448deab72adab981726517afe458beb01d

  • C:\Windows\PKSQOU\GQH.002

    Filesize

    44KB

    MD5

    1db8aa9ffda07a5f5559cbf25087147b

    SHA1

    eea77894bff8e24fb0861159927f67decb629184

    SHA256

    8cf369255b48195b8ecec1c7bf2e76924641880aa7311e6cf504ca534bbfcd62

    SHA512

    b9f80191dd8975c2e484eeec1bc7c6212d1b614061e69d96eda87b7a061a78a34de220f22607c3eb1c0fa37f152744a5c8f65a896e2884a9daf969db54a11704

  • C:\Windows\PKSQOU\GQH.004

    Filesize

    1KB

    MD5

    654b8c8ab1402317ee9ca99b86323e72

    SHA1

    9ed07abda3afc7b6cdf64a13469b0f2715bcc4a9

    SHA256

    c1096420bbc655cc5cb2c327c38b3fae704fd1f755f74d1780e6ec673a0c88ce

    SHA512

    c08f3b0c00d7e928fd2f10bd2907e101701b72caeb00765b708d1c8adf020afc0366c93aab06e2befbf516a1218c31033cd1cf2eeebf2e9ef85b1817d715217c

  • C:\Windows\PKSQOU\GQH.exe

    Filesize

    1.7MB

    MD5

    7dc8f94e34ad6f38e94f957043c39617

    SHA1

    081a26dc478bd3de6f2889b9c8da8b2e79723d8b

    SHA256

    618fb51d23c0ca116dbd24dc5e0240ebda862e405283d64871549321fde08202

    SHA512

    539c239670369f34e7907d072bdf6b91becb927454db3212b0c307363289b1900edffa2f9fac22d3d14435fcee28b7bdeee1f039f027d74f84627c85774b9f56

  • memory/4984-16-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB

  • memory/4984-18-0x0000000000770000-0x0000000000771000-memory.dmp

    Filesize

    4KB